lkml.org 
[lkml]   [2012]   [Jan]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: [PATCH 08/21] KEYS: Add signature verification facility [ver #3]
    Date
    Kasatkin, Dmitry <dmitry.kasatkin@intel.com> wrote:

    > It would also nice to have an API to supply pre-computed data hash. For
    > example IMA uses the same functionality to compute the hash of the file
    > content, and then, based on security.ima type decided either verify it using
    > just hash, or use digital signature. We could pass a hash as data. But may
    > be we do not want to have extra operation and compute hash over hash.

    If I understand you correctly, you'd like to have the option to do the hashing
    externally to this API? Would you supply the completed hash or just a hash
    with the data in it, and require this API to complete it (ie. chuck metadata
    into it)?

    I don't think it should be hard. I could add an alternative to
    verify_sig_add_data() perhaps. Either that or one function that does the lot
    and takes the precomputed hash as input. There would be no need for the split
    into four functions (begin, add_data, end, cancel) in such a case. The reason
    for the split is so that the caller can invoke add_data several times with
    non-contiguous bits of data.

    It might even make sense to expose the crypto hash object for direct access
    rather than use add_data - but that then makes it hard to use crypto hardware
    where you would just shovel the raw data into it and it does all the hashing
    and cryptography in a black box.

    David


    \
     
     \ /
      Last update: 2012-01-18 13:29    [W:3.073 / U:0.348 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site